A new domain with no policies is an office running on trust and luck. These are the ten Group Policies experienced admins set first - what each one does, where it lives, and the office problem it quietly solves every single day.
Ask ten experienced Active Directory admins which policies they configure on a fresh Windows Server domain and you will hear almost the same ten names. They are not exotic. They are the standard office set: the policies that stop password sharing, lock unattended screens, keep pen drives out, give every user their drives and printers automatically, and keep Windows updates from restarting the accounts PC in the middle of billing. This page walks through all ten one by one - the job each policy does, the exact console path, and the honest warning that comes with it. How to create, link and test a GPO from zero is covered in the full GPO tutorial on this channel; this list is about which ten to build once you know the basics.
One GPO per job, each with a plain name. Example names shown - the structure is the point, not the labels.
Path: Computer Configuration - Policies - Windows Settings - Security Settings - Account Policies - Password Policy, normally edited in the Default Domain Policy. This is the only policy in the list where the domain gets exactly one version for all domain accounts - a password policy linked to a single OU does nothing for domain users (per-group exceptions need Fine-Grained Password Policies, a separate feature).
Set a minimum length people can actually remember - 12 characters with complexity on beats 8 characters changed every month. Microsoft's own modern guidance has dropped forced frequent expiry, because users respond with Office@123, then Office@124. Length plus a sensible lockout policy is the honest combination.
Path: User Configuration - Policies - Administrative Templates - Control Panel - Personalization - enable the screen saver, set the timeout, and turn on password protect the screen saver. A computer-side twin, Interactive logon: Machine inactivity limit under Security Options, does the same job per machine.
Ten minutes is the office sweet spot. Someone walks away from an unlocked PC signed in as accounts or HR, and anyone passing by is suddenly that person. This policy closes the cheapest security hole in the building - and users accept it within a week, because it asks nothing except typing a password on return.
Path: Computer Configuration - Policies - Administrative Templates - System - Removable Storage Access. You can deny read, write or execute per device class, or deny all removable storage in one setting.
The office reason is data: one pen drive can carry the entire customer database out of the building, or carry a virus in. The honest warning: set this up with an exception route from day one - a security-filtered group for the two or three people with a genuine job need - or the policy will be quietly switched off the first time it blocks the boss before a presentation. Keyboards and mice are a different setting family (device installation restrictions); this policy is about storage.
Path: User Configuration - Preferences - Windows Settings - Drive Maps. This is a Group Policy Preference, not a classic policy: you point a drive letter at a share, choose the action (Create or Update), and use item-level targeting if accounts should get S: and sales should not.
This policy retires the oldest script in IT - the logon batch file - and the daily server wala drive gayab ho gaya call. Map once on the server and every user signs in to the same letters pointing at the same shares. A mapped drive showing a red cross is then instantly readable: a network or permissions problem, not a mapping mystery.
Path: Preferences - Control Panel Settings - Printers (or deploy from Print Management). The user signs in and the office printer is simply there, with the right driver from the print server.
The honest modern caveat: since the PrintNightmare fixes, Windows is strict about printer drivers - standard users generally cannot install a brand-new driver, so the driver should already live on the print server and be pre-staged by an admin. Deployment by GPO still removes the per-PC visit; it just no longer removes the one-time driver planning. Target printers by OU or group so the third floor stops printing to the ground floor.
Path: Computer Configuration - Policies - Administrative Templates - Windows Components - Windows Update. Key settings: Configure Automatic Updates, No auto-restart with logged on users, install deadlines, and - if the office uses WSUS - the intranet update server location. Deferral settings let a pilot group take updates first and the rest of the office a few days later.
Be clear about the job: this policy controls timing, not whether updates happen. The offices that get hurt are the ones that disable updates entirely and then meet a two-year-old vulnerability. Set an after-hours install window and a restart deadline users can see coming, and updates become boring - which is exactly what you want.
Path: User Configuration - Policies - Windows Settings - Folder Redirection. Documents, Desktop and Pictures quietly point at a folder on the file server instead of the local disk.
The payoff appears on the worst day: a PC dies, the user signs in on any other PC, and their files are already there - and the server copy sits inside your normal backup. Two honest warnings. The first sign-in copies existing files up, so roll out in small batches. And never redirect onto a slow or dying server: every save then feels broken, and users start saving to a pen drive instead - defeating policy number 3.
Paths: Computer Configuration - Windows Settings - Security Settings - Application Control Policies - AppLocker, or the older Software Restriction Policies in the same area. The idea is a whitelist: Windows, Program Files and admin-approved apps may run; whatever a user downloads into their own profile may not.
This is the strongest item on the list and the one demanding most respect. AppLocker enforcement through GPO is an Enterprise and Education edition feature, and every admin should start in Audit only mode, fix what the log reveals, and only then enforce. Done patiently, it quietly stops most fake-invoice malware. Done in a Friday hurry, it stops the billing software - that story has its own page in this series.
Path: Computer Configuration - Policies - Windows Settings - Security Settings - Advanced Audit Policy Configuration. At minimum, audit logon success and failure on domain controllers and member servers.
Auditing answers the question every office asks after an incident: whose account was used, from which PC, and when? But be honest about the second half: logs nobody reads are not security, they are storage. Switch auditing on together with a small weekly habit of actually reading failures - a companion guide in this series covers that habit in full.
Path: Preferences - Control Panel Settings - Local Users and Groups can clean the Administrators group on every PC - remove stray user accounts, keep the IT support group. The companion piece is Windows LAPS, which gives every PC a unique, automatically rotated local administrator password stored safely in Active Directory.
Daily work does not need admin rights; malware inherits them. When every user is a local admin, one bad download owns the machine and starts hunting the network from inside. Remove standing admin rights, keep LAPS for the day IT needs the local password, and half the incidents in a normal office never happen. Keep one tested break-glass route before rollout - the cautionary guide in this series explains why.
All ten policies created and linked live on a real Windows Server domain - watch the video once and your own list will take under an hour.
▶️ Watch Full VideoStart with the password policy and the screen lock - they cost users almost nothing and close the two most common holes. Then do drive mapping and printer deployment, because users feel those as help rather than restriction, and the goodwill carries the stricter policies (USB control, software control, local admin removal) that come later.
For domain accounts, a password policy only takes effect from a GPO linked at the domain level - the Default Domain Policy is the usual home. A password policy linked to an OU applies only to local accounts on those computers. Different rules for a specific group need Fine-Grained Password Policies, which are configured separately in Active Directory.
You can, and you should not. One GPO per job - with a plain name like Block-USB-Storage - can be tested, disabled, rolled back and filtered independently. One giant GPO fails as a giant: when something breaks you cannot switch off half of it, and nobody remembers what is inside. The one-GPO-per-job guide in this series shows the discipline in practice.